Privacy policy
Privacy Policy
Last updated: August 2026
Throughout this Privacy Policy, “Amy & Co.”, “we”, “us” and “our” refer to Amy & Co.
This Privacy Policy explains which personal data we process when you visit our online store, use our services, place an order or otherwise contact us.
1. Personal Data We Process
Depending on how you use our online store, we may process the following categories of personal data:
- first and last name
- billing and shipping address
- email address
- telephone number
- order and transaction data
- products purchased or viewed
- shopping cart contents
- payment information
- customer account and login data
- communications with our customer service
- IP address
- browser and device information
- usage and interaction data
- cookie and consent information
- where applicable, information about the source of a website visit or interactions with advertisements
2. Purposes and Legal Bases for Processing
We process personal data only where there is a lawful basis for doing so.
Performance of a Contract and Pre-Contractual Measures
We process personal data where necessary to:
- receive and process orders
- process payments
- ship goods
- provide customer accounts
- process returns, refunds and complaints
- send order and shipping information
- respond to customer enquiries
The legal basis is Article 6(1)(b) GDPR.
Without the personal data required to process an order, we may not be able to properly perform a purchase contract.
Legal Obligations
We process and retain certain personal data in order to comply with legal obligations, in particular tax, accounting and commercial record-keeping requirements.
The legal basis is Article 6(1)(c) GDPR.
Legitimate Interests
Where necessary, we may process personal data for the purposes of our legitimate interests, in particular:
- security of our online store
- fraud prevention
- detection of misuse
- technical stability
- handling and documenting customer enquiries
- establishment, exercise or defence of legal claims
The legal basis is Article 6(1)(f) GDPR.
Consent
For certain types of processing, in particular newsletters, non-essential cookies, analytics and personalised advertising, we obtain your consent where required.
The legal basis is Article 6(1)(a) GDPR and the applicable provisions of Austrian telecommunications law.
You may withdraw your consent at any time with effect for the future.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
3. Shopify
Our online store is operated using Shopify.
Shopify provides us with technical infrastructure and functionality including:
- operation of the online store
- product presentation
- shopping cart functionality
- checkout
- order management
- customer accounts
- security features
- certain analytics and marketing functions
In connection with your use of our online store, personal data may be transmitted to and processed by Shopify.
Shopify may also process personal data outside the European Economic Area. Where this occurs, appropriate legal safeguards for international data transfers are used in accordance with applicable data protection law.
Further information about how Shopify processes personal data can be found in Shopify’s privacy information.
4. Orders, Payments and Shipping
When you place an order, we may process in particular:
- your name
- billing address
- shipping address
- email address
- telephone number, where provided
- products ordered
- order value
- payment and transaction information
We process this data in order to fulfil your order and perform the purchase contract.
Where necessary, personal data may be disclosed to categories of recipients such as:
- payment service providers
- banks
- shipping and logistics providers
- fulfilment providers
- IT and hosting providers
- accounting or tax advisers
- public authorities where we are legally required to disclose information
5. Payment Service Providers
Depending on the payment methods offered at checkout, personal data may be transmitted to the relevant payment service provider.
This may include:
- payment information
- billing information
- contact information
- transaction information
We generally do not store full credit card details ourselves where payment processing is handled by a third-party payment provider.
Payment services offered through Shopify and other payment providers displayed at checkout, such as PayPal, may be used.
The processing is generally carried out for the performance of the purchase contract pursuant to Article 6(1)(b) GDPR and, where applicable, for compliance with legal obligations.
6. Shipping and Fulfilment
For the processing and delivery of orders, personal data required for fulfilment may be transmitted to shipping, logistics and fulfilment partners.
This may include:
- name
- shipping address
- telephone number, where required for delivery
- email address, where required for shipping notifications
- order and product information
For order fulfilment, we may use services such as CJdropshipping and, where applicable, AutoDS.
Depending on the product, warehouse location and destination country, personal data may also be transmitted to partners outside the European Economic Area.
Such transfers take place only in accordance with the applicable data protection requirements.
The processing is carried out in particular on the basis of Article 6(1)(b) GDPR, as the transmission may be necessary in order to deliver the goods you ordered.
7. Contacting Us
If you contact us by email or through another communication channel, we process the information you provide in order to respond to your enquiry.
This may include:
- your name
- email address
- the content of your enquiry
- where applicable, your order number and order details
Depending on the nature of your enquiry, the legal basis is:
- Article 6(1)(b) GDPR, where the enquiry relates to a contract or order; or
- Article 6(1)(f) GDPR, where processing is based on our legitimate interest in efficiently handling customer enquiries.
8. Newsletter and Email Marketing
If you subscribe to our newsletter, we use your email address to send you information about Amy & Co., our products, offers, promotions and news.
For newsletter subscriptions and email marketing, we may use SendWILL / CWILL or similar Shopify applications.
The processing is based on your consent pursuant to Article 6(1)(a) GDPR.
You may withdraw your consent at any time, in particular by:
- using the unsubscribe link contained in our marketing emails; or
- contacting us at info@amyandco.shop
After unsubscribing, you will no longer receive marketing newsletters unless another lawful basis applies.
Transactional emails, such as order confirmations and shipping notifications, may still be sent independently of your newsletter subscription.
9. Product Reviews – Judge.me
We may use Judge.me to provide product review functionality.
Personal data may be processed where necessary to:
- provide review functionality
- associate a review with an order
- display a submitted review
This may include:
- name
- email address
- order information
- product reviewed
- review content and rating
- images or other content uploaded as part of a review
Automatic review request emails may be enabled or disabled depending on our configuration.
Depending on the specific processing activity, the legal basis may be the performance of a contract, your consent, or our legitimate interest in collecting customer feedback and displaying authentic product reviews.
10. Cookies and Similar Technologies
Our online store uses cookies and similar technologies.
Technically necessary cookies may be required for purposes such as:
- shopping cart functionality
- checkout
- login
- security
- storing language or other preferences
- fraud prevention
- technical operation of the online store
Where such technologies are strictly necessary to provide a service expressly requested by the user, no additional consent is required.
Other cookies and similar technologies, in particular those used for:
- statistics
- analytics
- marketing
- personalised advertising
- conversion measurement
are used only after obtaining your consent where required by law.
You can manage your preferences and withdraw previously given consent through the cookie settings available in our online store.
11. Google Analytics
We may use Google Analytics 4, a web analytics service provided by Google.
Google Analytics helps us understand how visitors use our online store.
The following information may be processed in particular:
- IP address
- device and browser information
- pages visited
- date, time and duration of visits
- interactions with products and website content
- source of the website visit
- approximate location information
- technical identifiers
Where required by law, Google Analytics will only be activated after you have given your consent.
The legal basis is Article 6(1)(a) GDPR.
You may withdraw your consent at any time through our cookie settings.
Personal data may also be processed outside the European Economic Area in connection with the use of Google services. Where this occurs, the legally required safeguards for international data transfers are applied.
12. Google Ads and Conversion Tracking
We may use Google Ads to advertise our products and measure the effectiveness of our advertising campaigns.
Where you have given the relevant consent, Google may receive information about whether you:
- visited our store through a Google advertisement
- viewed a product
- added a product to your shopping cart
- completed a purchase
This information may be used to measure and optimise the performance of advertising campaigns.
The legal basis, where consent is required, is Article 6(1)(a) GDPR.
You may withdraw your consent at any time through our cookie settings.
13. Meta – Facebook and Instagram
We may use services provided by Meta Platforms, in particular for advertising on Facebook and Instagram.
This may include use of the Meta Pixel or equivalent server-side or Shopify-based Meta integrations.
Where you have given the relevant consent, the following information may be processed:
- IP address
- browser and device information
- pages and products viewed
- shopping cart activity
- purchases
- date, time and value of an order
- interactions with advertisements
- technical identifiers
This information may be used to:
- measure advertising performance
- create audiences
- optimise advertising campaigns
- provide personalised advertising where permitted
The legal basis, where consent is required, is Article 6(1)(a) GDPR.
You may change or withdraw your consent at any time through our cookie settings.
Meta may also process personal data outside the European Economic Area. Where this occurs, the legally required safeguards for international data transfers are applied.
14. Social Media
Amy & Co. may maintain profiles on social media platforms such as:
- and, where applicable, TikTok
When you visit our profiles on these platforms, the privacy policies of the relevant platform operators also apply.
The existence of a social media profile does not automatically mean that a corresponding advertising or tracking pixel is active on our online store.
15. Fraud Prevention and Security
To protect our customers, orders and online store, we may process personal data for the detection and prevention of:
- fraud
- misuse
- unauthorised access
- security-related incidents
This may include:
- IP address
- payment information
- order information
- technical device information
The legal basis is our legitimate interest in maintaining a secure business environment pursuant to Article 6(1)(f) GDPR and, where applicable, the performance of a contract pursuant to Article 6(1)(b) GDPR.
16. Retention Periods
We retain personal data only for as long as necessary for the relevant purpose or for as long as statutory retention obligations apply.
Order, invoice and accounting data may in particular be retained in accordance with applicable tax and commercial record-keeping requirements.
Certain business and tax records may generally be subject to a statutory retention period of seven years under Austrian law.
Personal data may also be retained for longer where necessary for the establishment, exercise or defence of legal claims.
Data processed solely on the basis of consent will generally be deleted where the consent has been withdrawn and no other legal basis permits continued processing.
17. International Data Transfers
Some of our service providers may process personal data outside Austria or outside the European Economic Area.
Any such transfer will only take place in accordance with applicable data protection law.
Depending on the recipient and destination country, transfers may be based on:
- an adequacy decision by the European Commission
- appropriate safeguards such as Standard Contractual Clauses
- binding corporate rules
- another legally permitted transfer mechanism
18. Your Rights
Subject to the applicable legal requirements, you may have the following rights in relation to your personal data:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object to certain processing
- Right to withdraw consent
You may withdraw consent at any time with effect for the future.
To exercise your rights, please contact us at:
Where necessary to protect your personal data from unauthorised access, we may request appropriate proof of identity before processing your request.
19. Right to Lodge a Complaint
If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority.
In Austria, the competent supervisory authority is in particular:
Austrian Data Protection Authority
(Österreichische Datenschutzbehörde)
You may also contact us first at:
20. Minors
Our online store is not specifically directed at minors.
We do not knowingly collect personal data from children where special legal consent requirements would apply.
If you are a parent or legal guardian and believe that a child has unlawfully provided personal data to us, please contact us at:
21. Links to External Websites
Our online store may contain links to third-party websites or services.
The operators of those external websites are responsible for their own privacy practices.
We therefore recommend reviewing the privacy policies of the relevant external services.
22. Changes to This Privacy Policy
We may update this Privacy Policy where necessary to reflect changes in:
- legal requirements
- our business activities
- services used by us
- applications
- payment providers
- analytics or marketing technologies
The current version of this Privacy Policy will be made available in our online store.
23. Data Controller and Contact Details
The controller responsible for the processing of personal data in connection with this online store is:
Denise Tröstner
trading as Amy & Co.
Sankt Georgener Hauptstraße 65D
7000 Eisenstadt
Austria
Email: info@amyandco.shop
If you have any questions about the processing of your personal data or wish to exercise your data protection rights, please contact us using the details above.